CVE-2026-47378 Details
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base. This vulnerability is fixed in 2026.04.1.
A vulnerability in NocoDB prior to version 2026.04.1 allows public shared-view endpoints to expose values from hidden columns. This issue arises through three independent mechanisms: the groupBy function reveals raw values of specified columns, filter and sort arrays can manipulate hidden columns, facilitating unauthorized data extraction, and the related-data list accepts arbitrary link-column IDs from other tables within the same base. The vulnerability enables anyone with a shared-view UUID to directly access hidden-column values, verify them through row counts, or retrieve records from unrelated tables in the same base, all without requiring authentication.
Users can update to NocoDB version 2026.04.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocodb/nocodb/security/advisories/GHSA-4w6r-5c2j-qf5f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NocoDB | < 2026.04.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |